Netdev List
 help / color / mirror / Atom feed
From: Simon Horman <horms@kernel.org>
To: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
Cc: netdev@vger.kernel.org, krzysztof.kozlowski@linaro.org,
	linux-kernel@vger.kernel.org,
	syzbot+1c5368988052dc2d8201@syzkaller.appspotmail.com,
	stable@vger.kernel.org
Subject: Re: [PATCH v2 1/2] nfc: pn533: complete failed queued commands and keep queue moving
Date: Wed, 28 Oct 2026 15:40:32 +0000	[thread overview]
Message-ID: <20261028154032.GY257209@horms.kernel.org> (raw)
In-Reply-To: <20261027070136.1339-2-zhaofeng2@cmss.chinamobile.com>

On Tue, Oct 27, 2026 at 03:01:34PM +0800, Zhao Feng wrote:
> When pn533_wq_cmd() fails to send a queued command it silently drops
> it: the completion callback is never called, cmd_pending stays set and
> cmd_work is never rescheduled.  As a result:
> 
> - a synchronous caller sleeps forever in pn533_send_cmd_sync()'s
>   wait_for_completion();
> - an asynchronous caller is never completed, leaking its callback
>   context (e.g. struct pn533_data_exchange_arg, and the sock_hold()
>   reference for rawsock);
> - cmd_pending stuck at 1 makes every later command queue up without
>   ever being sent, freezing the device until unbind.
> 
> The broken error path is as old as the command queue, but it used to
> require an URB submission error to trigger; a device that stalls the
> OUT endpoint reaches it via the send timeout added by the next patch.
> 
> Call the command's completion callback with the error and reschedule
> cmd_work (unless the callback chained a direct command by returning
> -EINPROGRESS) so that every queued command completes with an error and
> the queue drains instead of freezing.
> 
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> Cc: <stable@vger.kernel.org>

I think this patch also warrants a Fixes tag.

I don't think it's necessary to repost just to address that,
rather you can just respond to this email with the appropriate tag.

Also, I note that this patch did not apply cleanly (using git am)
and thus the CI did not run. I think this is due to minor fuzz -
git am is very fussy about that. I am unsure if there is value in
reposting to address that.

I've looked over the review of v1 and the updates made in v2.
And overall this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

  reply	other threads:[~2026-10-28 15:40 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27  7:01 [PATCH v2 0/2] nfc: pn533: fix hung task on stalled USB send Zhao Feng
2026-10-27  7:01 ` [PATCH v2 1/2] nfc: pn533: complete failed queued commands and keep queue moving Zhao Feng
2026-10-28 15:40   ` Simon Horman [this message]
2026-10-29  2:02   ` Zhao Feng
2026-10-27  7:01 ` [PATCH v2 2/2] nfc: pn533: add timeout to USB frame send completion wait Zhao Feng
2026-10-28 15:40   ` Simon Horman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261028154032.GY257209@horms.kernel.org \
    --to=horms@kernel.org \
    --cc=krzysztof.kozlowski@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+1c5368988052dc2d8201@syzkaller.appspotmail.com \
    --cc=zhaofeng2@cmss.chinamobile.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox